exploiut-db：4 O+ i' J% x9 z
) A) N( X+ O, a9 B1 e" zFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
8 Y0 g, U& o1 r( b
& ?4 ~: l7 D/ t1 f- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
: b/ v( Q( Y$ |9 _: Z- Credit goes to: Mostafa Azizi, Soroush Dalili
4 q* y: L: L: h; ?8 V- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/2 F# E# ~* Y7 H, l& w9 f
- Description:+ F# ]3 v/ S% i1 N* a5 W
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is7 R) l s2 F& a
dealing with the duplicate files. As a result, it is possible to bypass
; Q+ q$ [' I/ ~0 H2 y1 h$ g0 ~, H. h! Ithe protection and upload a file with any extension.
6 _: k. d$ l: H) I# Z1 _$ u- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/ ], z, G# x' R+ }3 B2 P' J
- Solution: Please check the provided reference or the vendor website., W% m5 z/ z7 u; a! A/ v
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720) o/ `2 `7 C* H. i5 _3 r% s) `
"1 Q6 ~4 y" F% ^
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:( Y3 v4 e4 s4 ]2 m1 v
In “config.asp”, wherever you have:
- R2 }* a: J; ?% W( f6 S ConfigAllowedExtensions.Add “File”,”Extensions Here”! ~# O2 ?1 u' i G6 Y
Change it to:
2 M6 }; [6 U9 ^ ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”, b, I4 P/ O2 w6 s6 N G$ g
% {1 \7 y( I+ L
8 }9 U! G+ B" \$ |% [9 p- ?- s# m4 ?$ t
% v6 ^- L7 c3 n0 S: \# r! k
* l7 R$ }: q7 l! S, g
php测试无效
1 @ p$ t; L3 v6 y$ y9 d- D! \asp/aspx测试成功：
* c. V2 ?& D" ]' a' C. i* {来到/FCKeditor/editor/filemanager/connectors/test.html9 |+ R5 J5 ^3 s" `; O
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
4 [ p# c" |4 ?, N
# b' ^$ s8 R/ B* ~% ]. Hburpsuite上传包并修改，repeater
4 |, {$ K: l3 ]5 d名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp
$ \5 {, a! ~. k1 w! f" R- g
\+ a0 V4 G% g+ i7 G. S) F. e) n如图，webshell为：http://localhost/userfiles/file/asd(1).asp
Z4 l- M( [3 F8 l$ @, x4 n8 X" |2 d" o6 u9 Y6 A3 n7 g: m
|
发表于 2012-12-10 10:18:50
收藏
支持
反对